创建自定义Azure RBAC角色以允许用户交换portal.azure.com中的插槽

Question

I'm trying to create a Custom Role for developers to allow them to simply swap slots on our various WebApps. Here's the Role I've created to complete this:

{
"Name": "Swap Role",
"Id": "",
"IsCustom": true,
"Description": "Lets developers perform slot swaps.",
"Actions": [
  "microsoft.web/sites/diagnostics/siteswap/read",
  "microsoft.web/sites/slots/diagnostics/siteswap/read",
  "microsoft.web/sites/slots/slotsswap/action",
  "microsoft.web/sites/slotsswap/action"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
  "/subscriptions/{subscriptionId-1}/resourceGroups/Development",
  "/subscriptions/{subscriptionId-2/resourceGroups/Development",
  "/subscriptions/{subscriptionId}/resourceGroups/Test",
  "/subscriptions/{subscriptionId-2/resourceGroups/Test",
  "/subscriptions/{subscriptionId}/resourceGroups/Production",
  "/subscriptions/{subscriptionId-2/resourceGroups/Production"
]
}

The issue is that once I've applied this role to my test user, when I go to swap slots, my test users sees the errors "You do not have swap permission", "You do not have write permission" in the swap panel.

Is is possible to allow a user to swap slots without giving them full write permissions on a WebApp? What permissions am I missing?

Answer 1

While I dont know what exact permissions you need, according to the error text, I'd start with adding this to what you have already:

Microsoft.Web/sites/slots/Write

here's a full list of slot rbac actions:

Microsoft.Web/sites/applySlotConfig/Action
Microsoft.Web/sites/resetSlotConfig/Action
microsoft.web/sites/slots/analyzecustomhostname/read
Microsoft.Web/sites/slots/applySlotConfig/Action
Microsoft.Web/sites/slots/backup/Action
microsoft.web/sites/slots/backup/read
microsoft.web/sites/slots/backup/write
microsoft.web/sites/slots/backups/action
microsoft.web/sites/slots/backups/delete
microsoft.web/sites/slots/backups/list/action
Microsoft.Web/sites/slots/backups/Read
microsoft.web/sites/slots/backups/restore/action
microsoft.web/sites/slots/config/delete
Microsoft.Web/sites/slots/config/list/Action
Microsoft.Web/sites/slots/config/Read
Microsoft.Web/sites/slots/config/Write
microsoft.web/sites/slots/containerlogs/action
microsoft.web/sites/slots/containerlogs/download/action
microsoft.web/sites/slots/continuouswebjobs/delete
microsoft.web/sites/slots/continuouswebjobs/read
microsoft.web/sites/slots/continuouswebjobs/start/action
microsoft.web/sites/slots/continuouswebjobs/stop/action
Microsoft.Web/sites/slots/Delete
microsoft.web/sites/slots/deployments/delete
microsoft.web/sites/slots/deployments/log/read
microsoft.web/sites/slots/deployments/read
microsoft.web/sites/slots/deployments/write
microsoft.web/sites/slots/detectors/read
microsoft.web/sites/slots/diagnostics/analyses/execute/Action
microsoft.web/sites/slots/diagnostics/analyses/read
microsoft.web/sites/slots/diagnostics/aspnetcore/read
microsoft.web/sites/slots/diagnostics/autoheal/read
microsoft.web/sites/slots/diagnostics/deployment/read
microsoft.web/sites/slots/diagnostics/deployments/read
microsoft.web/sites/slots/diagnostics/detectors/execute/Action
microsoft.web/sites/slots/diagnostics/detectors/read
microsoft.web/sites/slots/diagnostics/frebanalysis/read
microsoft.web/sites/slots/diagnostics/loganalyzer/read
microsoft.web/sites/slots/diagnostics/read
microsoft.web/sites/slots/diagnostics/runtimeavailability/read
microsoft.web/sites/slots/diagnostics/servicehealth/read
microsoft.web/sites/slots/diagnostics/sitecpuanalysis/read
microsoft.web/sites/slots/diagnostics/sitecrashes/read
microsoft.web/sites/slots/diagnostics/sitelatency/read
microsoft.web/sites/slots/diagnostics/sitememoryanalysis/read
microsoft.web/sites/slots/diagnostics/siterestartsettingupdate/read
microsoft.web/sites/slots/diagnostics/siterestartuserinitiated/read
microsoft.web/sites/slots/diagnostics/siteswap/read
microsoft.web/sites/slots/diagnostics/threadcount/read
microsoft.web/sites/slots/diagnostics/workeravailability/read
microsoft.web/sites/slots/diagnostics/workerprocessrecycle/read
microsoft.web/sites/slots/domainownershipidentifiers/read
microsoft.web/sites/slots/functions/listsecrets/action
microsoft.web/sites/slots/functions/read
microsoft.web/sites/slots/hostnamebindings/delete
microsoft.web/sites/slots/hostnamebindings/read
microsoft.web/sites/slots/hostnamebindings/write
microsoft.web/sites/slots/hybridconnection/delete
microsoft.web/sites/slots/hybridconnection/read
microsoft.web/sites/slots/hybridconnection/write
microsoft.web/sites/slots/hybridconnectionnamespaces/relays/delete
microsoft.web/sites/slots/hybridconnectionnamespaces/relays/write
microsoft.web/sites/slots/hybridconnectionrelays/read
microsoft.web/sites/slots/instances/deployments/read
microsoft.web/sites/slots/instances/processes/delete
microsoft.web/sites/slots/instances/processes/read
microsoft.web/sites/slots/instances/read
microsoft.web/sites/slots/metricdefinitions/read
microsoft.web/sites/slots/metrics/read
microsoft.web/sites/slots/migratemysql/read
microsoft.web/sites/slots/networktrace/action
microsoft.web/sites/slots/networktraces/operationresults/read
microsoft.web/sites/slots/newpassword/action
microsoft.web/sites/slots/operationresults/read
microsoft.web/sites/slots/operations/read
microsoft.web/sites/slots/perfcounters/read
microsoft.web/sites/slots/phplogging/read
microsoft.web/sites/slots/premieraddons/delete
microsoft.web/sites/slots/premieraddons/read
microsoft.web/sites/slots/premieraddons/write
microsoft.web/sites/slots/processes/read
microsoft.web/sites/slots/publiccertificates/delete
microsoft.web/sites/slots/publiccertificates/read
microsoft.web/sites/slots/publiccertificates/write
Microsoft.Web/sites/slots/publish/Action
Microsoft.Web/sites/slots/publishxml/Action
Microsoft.Web/sites/slots/Read
microsoft.web/sites/slots/recover/action
Microsoft.Web/sites/slots/resetSlotConfig/Action
microsoft.web/sites/slots/resourcehealthmetadata/read
Microsoft.Web/sites/slots/restart/Action
microsoft.web/sites/slots/restore/read
microsoft.web/sites/slots/restore/write
microsoft.web/sites/slots/restorefrombackupblob/action
microsoft.web/sites/slots/restorefromdeletedwebapp/action
microsoft.web/sites/slots/restoresnapshot/action
microsoft.web/sites/slots/siteextensions/delete
microsoft.web/sites/slots/siteextensions/read
microsoft.web/sites/slots/siteextensions/write
Microsoft.Web/sites/slots/slotsdiffs/Action
Microsoft.Web/sites/slots/slotsswap/Action
microsoft.web/sites/slots/snapshots/read
Microsoft.Web/sites/slots/sourcecontrols/Delete
Microsoft.Web/sites/slots/sourcecontrols/Read
Microsoft.Web/sites/slots/sourcecontrols/Write
Microsoft.Web/sites/slots/start/Action
Microsoft.Web/sites/slots/stop/Action
microsoft.web/sites/slots/sync/action
microsoft.web/sites/slots/triggeredwebjobs/delete
microsoft.web/sites/slots/triggeredwebjobs/read
microsoft.web/sites/slots/triggeredwebjobs/run/action
microsoft.web/sites/slots/usages/read
microsoft.web/sites/slots/virtualnetworkconnections/delete
microsoft.web/sites/slots/virtualnetworkconnections/gateways/write
microsoft.web/sites/slots/virtualnetworkconnections/read
microsoft.web/sites/slots/virtualnetworkconnections/write
microsoft.web/sites/slots/webjobs/read
Microsoft.Web/sites/slots/Write
Microsoft.Web/sites/slotsdiffs/Action
Microsoft.Web/sites/slotsswap/Action